About hosts

An event's host field value is the name of the physical device from which the event originates. Because it is a default field, which means that Splunk Enterprise assigns a host to every event it indexes, you can use it to search for all events that have been generated by a particular host.

The host value is typically the hostname, IP address, or fully qualified domain name of the network host on which the event originated.

How Splunk Enterprise assigns the host value

Splunk Enterprise assigns a host value to each event by examining settings in the following order and using the first host setting it encounters:

1. Any event-specific host assignment specified in transforms.conf.

2. The default host value for the event's input, if any.

3. The default host value for the Splunk instance (indexer or forwarder) intially consuming the data.

An overview of these assignment methods and their use cases follows. Subsequent topics describe the methods in greater detail.

The default host value

If no other host rules are specified for a source, Splunk Enterprise assigns the host field a default value that applies to all data coming into the instance from any input. The default host value is the hostname or IP address of the Splunk Enterprise instance (indexer or forwarder) initially consuming the data. When the Splunk Enterprise instance runs on the server where the event occurred, this is correct and no manual intervention is required.

The default host for a file or directory input

If you are running Splunk Enterprise on a central log archive, or you are working with files forwarded from other hosts in your environment, you might need to override the default host assignment for events coming from particular inputs.

There are two methods for assigning a host value to data received through a particular input. You can define a static host value for all data coming through a specific input, or you can have Splunk Enterprise dynamically assign a host value to a portion of the path or filename of the source. The latter method can be helpful when you have a directory structure that segregates each host's log archive in a different subdirectory.

Event-specific assignments

Some situations require you to assign host values by examining the event data. For example, If you have a central log host sending events to Splunk Enterprise, you might have several host servers that feed data to that main log server. To ensure that each event has the host value of its originating server, you need to use the event's data to determine the host value.

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »